This guide is for every Steam user, and especially for people who chase free game giveaways, join community events or trade on the Community Market. It covers the security settings that matter most, the phishing and scam tactics you are most likely to meet, what to review on a regular basis, and the order in which to act if something looks wrong.
A Steam account holds games you paid for, possibly saved payment details, your friends list and, for some games, items with real market value. That makes accounts a target. The good news is that most account takeovers can be prevented with a handful of settings and habits.
A note on where we stand: this site has no account system, never asks you to sign in with Steam and offers no auto-claim tools. Our free game links go straight to official Steam store pages. Be suspicious of any site that says "sign in to get free games."
The Essentials: Do These First
Turn on the Steam Guard Mobile Authenticator
Steam Guard is Steam's two-factor authentication. It comes in an email version and a mobile app version. The mobile authenticator is more secure, and it is one of the conditions for avoiding holds on certain trading and Market features; check Steam's official support pages for the current rules. To set it up:
- Install the Steam app from your phone's official app store and confirm the developer is Valve.
- Sign in to the app with your account.
- Open the Steam Guard section, choose to add an authenticator, link your phone number and enter the SMS code.
- The app shows a recovery code. Write it on paper or store it in a password manager. Do not keep it as a screenshot in your photo gallery.
- From now on, signing in on a new device requires the code shown in the app, or a confirmation tap in the app.
Keep your recovery code safe
The recovery code lets you remove the authenticator if your phone is lost or replaced. Steam Support can help without it, but that process usually takes longer. Before switching phones, follow Steam's official instructions to move the authenticator.
Use a unique password
Do not reuse your Steam password anywhere else. Credentials leaked from other sites are routinely tried against Steam accounts, and this works very well against people who reuse passwords. A password manager that generates long random passwords is the simplest fix.
Protect the email account behind it
Your email is how a Steam password gets reset, so a compromised inbox puts your Steam account at risk. Turn on two-factor authentication for your email too, and give it a different password.
Common Phishing and Scam Tactics
Fake login pages
Scam sites imitate giveaway pages, tournament voting pages or trading sites. When you click "Sign in through Steam," a window that looks identical to Steam's appears, but it is fake. What to look for:
- Steam's real sign-in pages live on steampowered.com or steamcommunity.com. Read the address carefully and watch for look-alike letters or extra words.
- Some fake windows are drawn inside the web page, including a fake address bar. Try dragging the window outside the browser; a real browser window can leave it, a drawn one cannot.
- Safest of all: never sign in from a link someone gave you. Type the official address yourself or use the client.
QR code sign-in scams
The Steam app can scan a QR code to sign in on a computer. Scammers will invent reasons for you to "scan this code with your Steam app," which actually signs their computer into your account. Only scan a QR code when you are sitting at your own computer looking at Steam's official sign-in screen.
Impersonating friends or support staff
A friend's compromised account may send messages like "please vote for my team" or "I accidentally reported you, contact this admin." Steam Support does not reach out through chat or Discord and will never ask for your password or authenticator codes. Check with your friend through another channel first.
API key abuse
Steam offers Web API keys for developers. In the past, scammers who obtained someone's credentials registered an API key on the victim's account to monitor and intercept trades. Regular players do not need an API key. If you find a key on the Steam Community API key page that you never created, revoke it immediately and change your password.
Malware
Programs advertised as free cheats, cracks or auto-claimers may carry malware that steals browser data and sign-in tokens. Download software only from official or trusted sources.
A Routine Security Checklist
Every so often, review the following:
- Steam Guard is still set to the mobile authenticator.
- The email address and phone number on your account are correct.
- The list of authorized devices contains nothing you do not recognize.
- The API key page is empty, unless you are a developer.
- Wallet balance, purchase history and trade history look normal.
- No friends have suddenly started sending odd messages.
If Something Looks Wrong
- Sign in through the official site right away and change your Steam password.
- In the Steam Guard settings, sign out of all other devices.
- Check for and revoke any API key you did not create.
- Check whether your email was also compromised; if so, change its password and enable two-factor authentication.
- If you cannot sign in, request account recovery through help.steampowered.com. Our account recovery guide (Steam Account Stolen? Warning Signs, the Recovery Process and Hardening Steam Guard) walks through the process.
- If there are unknown charges, contact your card issuer as well.
Things to Watch Out For
- Never share authenticator codes: not with anyone claiming to be support, a moderator or a friend.
- Do not save passwords on shared computers: sign out when you finish on an internet café or shared PC.
- Do not lend your account: use Steam's official family features to share games.
- Rules change: Steam's security features and policies are updated from time to time; check Steam's official support pages for the current rules.
FAQ
Q: Is email-only Steam Guard good enough?
It is better than nothing, but if your inbox is compromised, the codes go with it. The mobile authenticator is more secure and also avoids some trading holds.
Q: A giveaway site wants me to sign in with Steam. Is that okay?
Be very careful. Claiming a free-to-keep game only requires clicking the button on the official Steam store page; no third-party sign-in is needed. Our free games page (Free Games) only links to official store pages.
Q: I lost my phone. What now?
Use your saved recovery code to remove the authenticator, then set it up again on the new phone. Without the code, contact Steam Support through its official site and be ready to prove ownership, for example with purchase records.
Q: Someone says my account was reported and I must contact an admin. Is it real?
This is a well-known scam script. Steam does not notify you of account problems through friend messages or third-party chat apps. Do not click links or contact the "admin" they name.
Q: Is it safe to save my card on Steam?
Steam protects stored payment details, but if your account is taken over, a saved card can be used for purchases. To reduce that risk, skip saving the card or pay with wallet funds instead.